openssl 3.6.2 [CVE-2026-34182] #72

New issue

Open

opened 2026-08-06 12:33:56 +00:00 by victor · 0 comments

victor commented

2026-08-06 12:33:56 +00:00

Member

Installed: 3.6.2
Upgrade to OpenSSL 3.6.3.

Issue Summary: Cryptographic Message Services (CMS) processing fails to perform
sufficient input validation on the cipher and tag length fields of
AuthEnvelopedData containers, leading to various potential compromises.

Impact Summary: Attackers making use of these vulnerabilities may achieve
key-equivalent functionality for a given CMS recipient and/or bypass integrity
validation for a given message.

In one use case, an attacker may send a CMS message containing
AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL
erroneously allows this selection, and attempts to decrypt and validate the
message.

Installed: 3.6.2 Upgrade to OpenSSL 3.6.3. Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message. In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the message.

victor added this to the v0.1.2 milestone

2026-08-06 12:33:56 +00:00

victor added the

Priority

Critical

Kind/Security

labels

2026-08-06 12:33:56 +00:00